← Database

CVE-2026-92439

N/A CVSS: N/A Published: 2026-11-10 Modified: 2026-11-10

Description

The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for another Service Provider to be replayed to authenticate to Kong.

Affected Platforms

Unknown

Weakness Type

CWE-287

References